DRAFT Designated Vendor Direction under section 105Z1 of the Communications Act 


2003, given to [Public Communications Providers] 


(produced for the purposes of a proposed consultation pursuant to section 105Z3(1) of the 


Communications Act 2003) 


Background 


1. Section 105Z1(1) of the Communications Act 2003 (“the Act’) provides that the 
Secretary of State may give a ‘designated vendor direction’ to a public communications 
provider if he considers that it is necessary in the interests of national security. Such a 
direction may impose requirements on a public communications provider with respect to 
the use of goods, services or facilities supplied, provided or made available by a 


‘designated vendor’ specified in the direction. 


2. On [DATE], the Secretary of State issued a ‘designation notice’ under section 105Z8 of 
the Act, designating Huawei Technologies (UK) Co., Limited and its affiliated companies 
(together, “the Huawei corporate group” or “Huawe1’’) for the purposes of a designated 


vendor direction. 


The Designated Vendor Direction 


3. The Secretary of State hereby imposes the following requirements, in accordance 
with Section 105Z1 of the Act, on [Public Communications Providers], with respect 
to the use of goods, services or facilities supplied, provided or made available by 


Huawei. 
4. Accordingly, [Public Communications Providers]:' 


(1) at any time after the date of this direction, must not make use of any Huawei 
equipment in their 5G networks if such equipment was procured after 31 


December 2020; 


(2) at any time after the date of this direction, must not make use of any Huawei 
equipment, except for fixed fibre access equipment, in any network if the 


manufacturing process or supply chain for such equipment has been altered 


' A table summarising the requirements imposed on [Public Communications Providers] is produced 
at Annex C to this Direction. 


as a result of changes to the United States Foreign-Produced Direct Product 


Rule announced on 19 May 2020 and 17 August 2020; 


(3) at any time after 31 March 2021, must not make use of Managed Services 
provided by or on behalf of Huawei in respect of any network, except where 
Specialist Maintenance Services are provided by or on behalf of Huawei in 
relation to Huawei equipment which was installed in the network prior to 31 
March 2021. 


(4) at any time after 30 September 2021, must not install, or allow to be installed, 
any Huawei equipment in 5G networks, except where such installation is for 
the purposes of directly maintaining Huawei equipment installed before this 


date. 


(5) at any time after 28 January 2023, must not make use of Huawei equipment 
or any services delivered by, or on behalf of, Huawei in the execution of their 


Core Network Functions. 


(6) at all times after 28 January 2023, must restrict the use of Huawei equipment 
in their 5G networks, so that: 


i. Huawei equipment serves at most 35% of each class of 5G Base 
Station sites on any particular 5G access network, calculated by the 


method specified at Annex B.1 to this Direction; 


ii. the network traffic volume passing through Huawei equipment in any 
particular 5G access network is at most 35% of the total expected 
network traffic volume for that particular 5G access network, 


calculated by the method specified at Annex B.2 to this Direction; and 


iii. in relation to any other functions which are part of the 5G access 
networks, at most 35% of the network elements from a particular 
equipment class in any particular network is provided by Huawei, 


calculated by the method specified at Annex B.3 to this Direction. 


(7) at all times after 28 January 2023, must restrict the use of Huawei equipment 
in their Fibre to the Property (FTTP) and other gigabit and higher capable 


access networks, so that: 


i. at most 35% of premises passed by a network are served by Huawei 
equipment, calculated by the method specified at Annex B.4 to this 


Direction; and 


ii. in relation to any other functions which are part of the networks, at 
most 35% of the network elements from a particular equipment class 
in any particular network is provided by Huawei, calculated by the 


method specified at Annex B.3 to this Direction. 


(8) at any time after 28 January 2023, must not make use of Huawei equipment 
or any services delivered by or on behalf of Huawei in parts of mobile access 
networks which could provide service to subscribers located within Sites 


Significant to National Security. 


(9) at any time after 31 December 2027, must not make use of Huawei 
equipment or any services delivered by, or on behalf of, Huawei in any part 


of its 5G networks. 


(10) to the extent that use of Huawei equipment or services in any network is 
not otherwise prohibited by the requirements set out above, must comply 
with the provisions for public telecommunications providers detailed in the 
National Cyber Security Centre’s (NCSC’s) specific mitigation strategy for 
Huawei (as it applies from time to time), insofar as the mitigation strategy 


requires that: 


i. [Public Communications Providers] must not use Huawei equipment 


unless: 


1. any such equipment has first been provided to the Huawei 


Cyber Security Evaluation Centre (“HCSEC”); 


2. all information relating to such equipment (including 
information in relation to the tooling used in its production) 
that the NCSC specifies from time to time as necessary for the 
purposes of HCSEC effectively evaluating its quality and 
security, has been provided to HCSEC; and 


ii. 


iii. 


iv. 


in light of [Public Communications Providers’] own analysis 
and the results of any evaluation by HCSEC, [Public 
Communications Providers] reasonably consider such 
equipment to be of satisfactory quality and security. Such 
equipment will not be of satisfactory quality and security 
unless it is of at least comparable quality and security to 
equivalent equipment produced by or on behalf of other 


vendors. 


[Public Communications Providers] must not install modifications to 


Huawei equipment (including modifications made by means of 


patches or updates) provided by or on behalf of Huawei, unless: 


1. 


any such modified equipment has been provided to HCSEC; 


all information relating to such modified equipment that the 
NCSC specifies from time to time as necessary for the 
purposes of effectively evaluating its quality and security, has 
been provided to HCSEC; and 


in the light of the results of any evaluation by HCSEC, [Public 
Communications Providers] reasonably consider the modified 
equipment to be of satisfactory quality and security. Such 
equipment will not be of satisfactory quality and security 
unless it is of at least comparable quality and security to 
equivalent equipment produced by or on behalf of other 


vendors. 


Unless otherwise agreed in writing with the NCSC, [Public 


Communications Providers] must not make use of any Huawei 


equipment within any of their networks where the notified 


end-of-support date for that equipment, or any individual component 


of that equipment, has passed. 


[Public Communications Providers] must provide the NCSC and 


HCSEC with full details of their current and planned use of Huawei 


equipment within all of their networks. 


v. [Public Communications Providers] must ensure that any access, 
whether physical or remote, to any of their networks is not granted to 
Huawei employees or individuals acting on behalf of Huawei, except 


where: 


1. in the case of physical access to [Public Communications 
Providers’] networks, such employees or individuals are 
accompanied by employees of the [Public Communications 
Provider] which the [Public Communications Provider] 
reasonably considers to be appropriately skilled to monitor 
any national security risks arising from the provision of such 


access; or 


2. in the case of remote access to [Public Communications 


Providers’] networks: 


a. except for the purposes of providing Specialist 
Maintenance Services, access is undertaken from 


within the United Kingdom; and 


b. access is monitored in real time by employees of the 
[Public Communications Provider] which the [Public 
Communications Provider] reasonably considers to be 
appropriately skilled to monitor any national security 


risks arising from such access. 


vi. [Public Communications Providers] must take all reasonable steps to 
enable testing and analysis of any Huawei equipment used within its 


networks as is reasonably required by the NCSC from time to time. 


5. This Direction shall come into force at midnight on [DATE]. 


Reasons for the Direction 


6. The Secretary of State considers that the Direction is necessary in the interests of national 
security and therefore satisfies the condition at section 105Z1(2)(a) of the Act, for the 


following reasons: 


(1) The Huawei corporate group is headquartered in, and controlled from, China. The 
Government assesses that the Chinese State and associated actors have carried 
out, and are expected to continue to carry out, cyber-attacks against the United 
Kingdom and the United Kingdom’s interests. In particular, the Chinese State and 
its associated actors continue to seek to exploit weaknesses in telecommunications 
service equipment, and/or in how providers of public electronic communications 


networks build and operate their networks, in order to compromise their security. 


(2) Chinese laws, including the National Intelligence Law 2017, permit the Chinese 
State to require companies based in China and their employees to engage in 
activities which are harmful to the United Kingdom. The way in which the rules 
are operated means such companies can be required to direct their subsidiaries to 
engage in activities which are harmful to the United Kingdom. Huawei’s 
employees can also be required to comply with directions issued by the Chinese 
State without the knowledge of Huawei. These powers give rise to a risk that 
covert and malicious functionality could be embedded in Huawei’s equipment. 
This risk will further increase if the United Kingdom's dependency on Huawei for 
the provision of Fibre to the Property (FTTP) networks and Mobile Access (MA) 


networks increases. 


(3) The cyber security and engineering quality of Huawei’s products and services is 
low and its processes are opaque, giving rise to a real risk of hostile exploitation 
and/or systemic failures. In this regard, the Huawei Cyber Security Evaluation 
Centre Oversight Board has raised significant concerns about Huawei’s 


engineering processes in its 2018, 2019 and 2020 annual reports. 


(4) The Secretary of State’s concerns over the quality of Huawei’s products and 
services have been exacerbated by sanctions imposed by the United States against 
Huawei. These sanctions are likely to reduce the reliability of Huawei’s products 


and services and to make it harder to remedy any deficiencies. Further: 


i. As a result of changes to the United States’ Foreign-Produced Direct 
Product Rule in May 2020 and August 2020, set out in the Export 
Administration Regulations made under the US Export Control Reform 
Act 2018, Huawei is now unable to purchase or manufacture equipment, 
in particular semiconductors, where they are designed or produced using 


specified United States technology, unless companies or persons 
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supplying Huawei with goods containing such technology have applied 
for, and been granted, a licence to do so by the United States Government. 
There is a legal presumption of denial of any application for a licence and, 
for items such as semiconductors for 5G equipment, it is not anticipated 
that any such licences will be granted. As a result of this serious impact on 
Huawei’s manufacturing processes and supply chains, Huawei will be 
forced to manufacture semiconductors and other equipment with unknown 
and untested tools under extreme time pressures. Because these tools are 
untried and untested, adequate oversight is significantly more challenging 


and potentially impossible. 


ii. The ongoing effect of sanctions, the risk of future enforcement and 
escalation of those sanctions, as well as the expiry in August 2020 of the 
“Temporary General License’ granted by the United States (which permits 
some supply to Huawei), have the potential to affect, without advance 
notice, Huawei’s ability lawfully to provide Managed Services (support 
and maintenance services which are designed to ensure the continued 


day-to-day operation of networks). 


ii. As a result of the impact of US sanctions, Huawei is now expected to 
move significant aspects of its supply chains to China and is increasingly 
reliant on the use of Chinese technology. As a result, in its involvement in 
the United Kingdom’s Fibre to the Property (FTTP) networks and Mobile 
Access (MA) networks, Huawei is increasingly reliant on unknown and 


untested components. This raises serious national security concerns. 


(5) Huawei has a significant market share in the United Kingdom’s FTTP and MA 
networks, estimated at 44% and 35% respectively. In light of Huawei’s size and 
the scale of its operations, it has the ability to increase its market shares in the 
FTTP and MA networks in a way which creates a significant risk of national 
dependency. Without intervention, it is highly likely that the United Kingdom will 
become dependent on Huawei for the provision of FTTP and MA networks. 
These networks form part of the United Kingdom’s critical national infrastructure. 
Due to the national security concerns set out at sub-paragraphs (a) to (d) above, 


dependency on Huawei significantly increases the potential impact of any 


systemic failures or hostile exploitation and therefore gives rise to unacceptable 


risks to national security. 


7. The Secretary of State considers that the requirements imposed by the Direction are 
proportionate to what is sought to be achieved by it, and therefore satisfy the condition at 


section 105Z1(2)(b) of the Act for the reasons set out below. 


(1) Use of Huawei equipment procured after 31 December 2020 in 5G networks 


8. The Direction requires the overall phasing out and ultimate termination of Huawei’s 
involvement in 5G networks in the interests of national security. The use by Public 
Communications Providers of Huawei equipment procured after 31 December 2020 in 5G 
networks would undermine this overall aim. This requirement ensures that Public 
Communications Providers remain on the ‘pathway to zero’ by discouraging them from 
procuring, and therefore installing in their 5G networks, new Huawei equipment, and 


encouraging them to procure new equipment from other vendors. 


(2) Huawei equipment which is affected by changes to the US Foreign-Produced Direct 
Product Rule 


9. As a result of changes to the United States Foreign-Produced Direct Product Rule, 
Huawei is unlikely to be able to continue relying on US technology and software in the 
design and production of its equipment, in particular semi-conductors. These 
developments will force significant changes to Huawei’s manufacturing processes and 
supply chains, which in turn will mean that effective oversight over Huawei equipment 


supplied to the United Kingdom will become more challenging, or even impossible. 


(3) Receipt of Managed Services 


10. Managed Service arrangements give providers significantly higher levels of access to 
networks and/or sensitive data transmitted via or stored in such networks than most other 
service relationships. The level of access is such that a Managed Service provider has the 
potential to cause major network disruption and/or access quantities of sensitive data on a 
scale which undermines national security. In light of this threat, the Secretary of State 
considers that the national security risk of Huawei providing Managed Services is 
unmanageable. This risk has been further exacerbated by a series of United States 
sanctions imposed on Huawei, which have the potential to affect, without advance notice, 


Huawei’s ability lawfully to undertake any Managed Service arrangements. 


11. 


The Secretary of State considers that the implementation date of 31 March 2021 is 
achievable, and is necessary given the seriousness of the security risks of a longer period 


for compliance. 


(4) Installation of Huawei equipment in 5G networks after 30 September 2021 


12. The Direction requires the overall phasing out and ultimate termination of Huawei’s 


13. 


involvement in 5G networks in the interests of national security. The installation by 
Public Communications Providers of Huawei equipment after 30 September 2021 would 
undermine this overall aim. This requirement ensures that Public Communications 
Providers remain on the ‘pathway to zero’ by encouraging them to install equipment 


produced by other vendors. 


The cut-off point of 30 September 2021 is intended to give Public Communications 
Providers sufficient time to prepare for installation of equipment produced by other 
vendors; bearing in mind that factors such as the continued outbreak of Covid-19 or 
environmental interruptions (for example, flooding) might prevent Public 
Communications Providers from complying with an earlier date. The Secretary of State 
also considers it proportionate to exclude from these requirements installation of Huawei 
equipment for the purposes of maintaining equipment installed before 30 September 


2021. 


(5) Use of Huawei equipment or any services delivered by, or on behalf of, Huawei in the 


execution of Core Network Functions 


14. 


15. 


The network ‘core’ is where critical functions are carried out and where the most 
sensitive data about a network’s users is stored. Disruption to Public Communications 
Providers’ Core Network Functions could lead to significant interference with the 
operation of the network, including widespread loss of services, and significant data 
breaches. Because of the importance and sensitivity of the Core Network Functions, 


Huawei’s cyber-security risk profile cannot be managed. 


Pursuant to this Direction, the Secretary of State has given affected operators until 28 
January 2023 to phase out Huawei involvement in their Core Network Functions. This 
provides sufficient time for Public Communications Providers to switch to new vendors 


without incurring the risks associated with rapid vendor change, whilst also balancing the 


risks of allowing Providers to retain Huawei involvement in Core Network Functions in 


the short-to-medium term. 


(6) 35% cap on use of Huawei equipment in 5G access networks; and (7) 35% cap on use of 


Huawei equipment in FTTP and other gigabit and higher capable access networks 


16. 


These Directions are necessary to reduce Public Communications Providers’ dependence 
on Huawei in the medium-term and to place them on a path to removing Huawei 
equipment in the longer term. However, placing the cap at lower than 35% or introducing 
an earlier deadline would risk the resilience of UK networks, given the current lack of 
diversity of supply in the market. The Secretary of State has therefore sought to balance 
the imperative of reducing Huawei equipment with the need to protect the medium-term 


resilience of the UK network. 


(8) Sites Significant to National Security 


17. 


18. 


19. 


This element of the Direction is required because there are locations where pure metadata 
about the number, type and distribution of devices connected to Public Communications 
Providers’ local base stations could be used to establish information which could pose a 


significant risk to the United Kingdom’s national security. 


The Secretary of State has sought to balance the risk of Huawei having access to parts of 
mobile networks which could provide service to subscribers located at Sites Significant to 
National Security with the need to provide Public Communications Providers sufficient 
time to change their vendor arrangements without suffering from the risks associated with 


rapid vendor change. 


Pursuant to section 105Z1(7) of the Act, the Secretary of State is not required to specify 
the reasons for the direction if, or to the extent that, he considers that doing so would be 
contrary to the interests of national security. Because public disclosure of the Sites 
Significant to National Security would give rise to national security risks, they have not 
been set out in this Direction but have been provided on a confidential basis to the Public 


Communications Providers subject to the Direction. 


(9) Ending Huawei involvement in 5G networks by 31 December 2027 


20. 


The Secretary of State has sought to balance national security risks with the need to 


provide Public Communications Providers sufficient time to transition to new vendors. 
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21. 


Because 5G networks will be of an even greater importance to the United Kingdom by 
2027, and because of the expected availability of more reliable alternative vendors by this 
date, the Secretary of State considers that Huawei’s presence in the United Kingdom’s 5G 
networks beyond 31 December 2027 will constitute an unmanageable and unnecessary 


national security risk. 


Further, as explained at paragraph 9 above, Huawei equipment, for which the 
manufacturing process or supply chain has been affected by changes to the United States 
Foreign Direct Product Rules, will be produced using untried and untested components 
which would not be capable of being subjected to adequate oversight. As a result, Public 
Communications Providers will only be able to rely on stockpiles of equipment and parts 
unaffected by United States sanctions to maintain Huawei involvement in their 5G 
networks. The Secretary of State considers that, after 31 December 2027, there will no 
longer be enough spare equipment and parts of a sufficiently high security standard. As a 
result, there are significant national security risks of allowing Public Communications 
Providers to continue with Huawei involvement in any element of their 5G networks after 
this date. Though the existing supply of equipment and spares of a sufficiently high 
security standard may be exhausted after 31 December 2027, the Secretary of State 
considers that a longstop date is needed to ensure market certainty and long-term network 


security. 


(10) National Cyber Security Centre’s specific mitigation strategy for Huawei 


22. Public Communications Providers will still, in certain circumstances, be able to use 


23. 


Huawei equipment and services after this Direction takes effect. Public Communications 
Providers have overall responsibility to manage the national security risks associated with 
the use of Huawei equipment and services. However, in accordance with the NCSC’s 
advice, the Secretary of State does not consider that Public Communications Providers 
are able to do so effectively except within the constraints of a national mitigation strategy 
overseen by the NCSC. It is therefore proportionate that any ongoing use is subject to the 
elements of the NCSC’s specific mitigation strategy for Huawei that are intended to bind 


Public Communications Providers. 


The Direction recognises the key role that HCSEC plays in the Huawei mitigation 
strategy, and is also intended to ensure HCSEC’s continued effective operation. However, 
the Secretary of State will reconsider the entirety of this Direction in the event that 


HCSEC is no longer in a position adequately to fulfil its functions. 
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Interpretation 


24. In this Direction: 


‘SG network’ means a set of all relevant network infrastructure elements for 
mobile and wireless communications technology used for connectivity and 
value-added services with advanced performance characteristics, such as very 
high data rates and capacity, low latency communications, ultra-high reliability, 
or supporting a high number of connected devices. These may include legacy 
network elements based on previous generations of mobile and wireless 
communications technology such as 4G or 3G. 5G networks should be understood 


to include all relevant parts of the network. 


‘SG Base Station’ means any class of base station supporting or routing 
functionality added in the Third Generation Partnership Project’s Release 15 or 


later releases. 


‘Core Network Function’ means one of the functions listed at Annex A to this 


Direction. 


‘Huawei equipment’ means any product (including non-passive component parts) 
or software designed, produced, developed, assembled or manufactured by or on 
behalf of Huawei, which is intended for use as part of a telecommunications 
network including but not limited to carrier grade telecommunications hardware 


and enterprise hardware. 


‘Managed Services’ means support and maintenance services which are designed 


to ensure the continued day-to-day operation of networks. 


‘National Cyber Security Centre’ or ‘NCSC’ means Government 
Communications Headquarters acting through the National Cyber Security 


Centre. 


A list of ‘Sites Significant to National Security’ has been provided on a 
confidential basis to the Public Communications Providers subject to this 


Direction. 


‘Specialist Maintenance Services’ means third-line support maintenance for 


Huawei’s equipment which only Huawei can provide. 
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i. The date on which equipment is ‘procured’ shall be taken to be the date on which 


the transaction is initiated. 


[Direction given by the Secretary of State] 


DATE 
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ANNEX A: List of Core Network Functions 


For all mobile and fixed networks, including 5G networks: 


Internet Protocol Core (including any function which performs Internet 
Protocol/Multiprotocol Label switching or routing across the core of a provider’s 


network); 
Security Functions; 


Operational Support Systems (OSS) (except to the extent necessary to support any 


Huawei equipment deployed in a provider’s network); 
Management and Authentication; 
Authorisation and Audit (AAA) functions; 


Virtualisation infrastructure (including Network Function Virtualisation Infrastructure 


(NFVD); 


Orchestrator and controller functions (including Management and Network Orchestration 


(MANO) and Software Defined Networks (SDN) orchestrators/controllers); 
Network monitoring and optimisation; 


Interconnection equipment (including high data rate transmission and routing equipment 
used to connect core data centres, for peering used to connect operator networks or used 


over international connections); 
Internet gateway functions; and 


Lawful Intercept related functions. 


For all 5G networks: 


5G core database functions; 
5G core-related services including but not limited to: 


o Authentication Server Function (AUSF), 
o Access and Mobility Management Function (AMF), 
o Unstructured Data Storage Function (UDSF), 


o Network Exposure Function (NEF), 
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Intermediate NEF (I-NEF), 

Network Repository Function (NRF), 

Network Slice Selection Function (NSSF), 
Policy Control Function (PCF), 

Session Management Function (SMF), 

Unified Data Management (UDM), 

Unified Data Repository (UDR), 

User Plane Function (UPF), 

UE radio Capability Management Function (UCMF), 
Application Function (AF), 

5G-Equipment Identity Register (SG-EIR), 
Network Data Analytics Function (NWDAP), 
Charging Function (CHF), 

Service Communication Proxy (SCP), 

Security Edge Protection Proxy (SEPP), 
Non-3GPP InterWorking Function (N3IWF), 
Trusted Non-3GPP Gateway Function (TNGF), 


Wireline Access Gateway Function (W-AGF); and 


e Future 5G core functions as specified by 3GPP TS 23.501. 
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ANNEX B: calculation of the 35% caps 


The following methods are based on the NCSC’s FAQs in relation to its January 28 2020 ‘advice 


on the use of equipment from High Risk Vendors (HRVs) in UK telecoms networks’, as the 
FAQs stood on the date this Direction was published. 





Annex B.1: calculation of the 35% site cap for 5G access networks 


Firstly, operators should classify their sites based upon type (e.g. small cells, macrocells). For 
example, the ITU has defined five basestation classes within ITU-T K.100. These classes (E0, E2, 
E10, E100, E+) determine where and how the equipment should be deployed. 


Secondly, for each class, operators should determine the size of two sets: 


Sics: the set of sites supported by the operator of a particular ‘class’ that are providing Rel-15 or 


class]* 


later features or functionality to handsets/UEs. Note that this could include upgraded 4G sites. 


S jetassj(Huawei) the subset of sites within °S,.,,.. where a non-passive function of the basestation is 


class 


provided with the involvement of Huawei equipment. 


Based upon these sets, operators should ensure that, for every class, the following equation is 


true:? 


#S [class] (Huawei) <0.35 
#S i a 


class] 
In other words, our advice is that for each class, the percentage of Huawei-supported sites is at 
most 35%. Correspondingly, at most 35% of small cells and at most 35% of macro cell functions 


may be provided by Huawei equipment. 


Only the sites operated by the operator should be included in this calculation. Consequently, 


RAN-sharing agreements do not impact this calculation. 


For the avoidance of doubt, the cap applies to any sites which are offering ‘5G’ (3GPP Rel-15 or 
later) features or functionality to handsets. Hence if a site offers any 5G functionality, it is a ‘SG 
site’ and is included in the cap. ‘Dynamic Spectrum Sharing’ across 4G and 5G is a 5G feature 
> Where ‘#S’ is used to denote the size of the set ‘S’. 
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and hence sites with this capability are included in the cap. However, if it is capable of offering 


5G functionality, but these features are disabled, it is not included in the cap. 


As an example, if an operator has 20K macro cell sites (class E+) and has updated or upgraded 
6K of them to support Rel-15 or later features (#S,,, = 6000). If additionally, the operator has 2K 
small cells (class E10) and installed or upgraded 1K of them to Rel-15 or later features (#S,,,) = 


1000). Then: 


#S p, (Huawei) <0.35. #S p, = 2100 
And: 


#S 19 (Huawei) 50.35. #S p10 = 350 


Hence, the operator may have up to 2100 Rel-15 or later macro cell sites with non-passive 
components from Huawei, and at most 350 Rel-15 or later small cell sites with non-passive 


components from Huawei. 


Operators should also ensure that traffic quantities and equipment quantities are also within the 


cap, as described in Annex B.2 and Annex B.3 
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Annex B.2: calculation of the 35% traffic cap for 5G access networks 


The traffic cap should be calculated based on the total traffic passing through ‘5G’ sites over a 


year. It is based on the traffic routed over the network from UEs within the following two sets: 


U: The set of UEs where the operator’s RAN is offering features or functionality defined in 3GPP 
Rel-15 or later. 


U(Huawei): The subset of UEs within ‘U’ where some non-passive aspect of basestation 
connectivity has the involvement of Huawei equipment. To be clear, where a UE is supported by 
multiple basestations, involvement of Huawei equipment in either function would cause the UE 
to be within the set. In the case of 5G Option 3A, this would apply if Huawei equipment is 
involved in either the eNB signalling anchor, or the gNB carrying 5G traffic. 


Based on these sets, operators should ensure that the following equation is true: 


> |U(Huawei)| 
= £035 
2 |U] 
year 
The advice applies to traffic going over the operator’s RAN regardless of the destination core 
network, or the customer relationship. Traffic from another operator’s RAN is not included in the 


calculation, but MVNO or RAN-share traffic going over the operator’s own RAN is included. 


For the avoidance of doubt, the traffic quantities are only calculated for handsets offered any 5G 
(Rel-15 or later) functionality, regardless of whether the handset uses that offered functionality. 
Hence, it will generally be calculated based on the amount of traffic going through the ‘5G sites’ 
identified in Annex B.1. However, if a UE is passing traffic through both 4G and 5G sites (e.g. 
5G’s Non-Stand Alone Option 3), that UE has been offered a ‘5G’ feature and all that UE’s 
traffic should be included in the cap, regardless of whether the traffic is routed through a 4G or 


5G basestation. 


As an example, if the operator routes 10PB of data over a year, from UEs which are being offered 


Rel-15 or later features by the network, then )'‘year|U|=/0PB. In this case: 


3 Using the notation that |U] is the traffic routed over the network from UEs within the set U, 
and J year|U]| is the traffic routed over the network throughout a year from UEs within the set U. 
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>» |U(Huawei)| <0.35. >) |U| = 3.5PB 
y 


year ear 


Consequently, over the course of that year, the operator may route up to 3.5PB from UEs offered 


Rel-15 or later functionality, where the support of a Huawei function is utilised. 


Where the precise traffic quantities cannot be calculated, then the use of reasonable, unbiased 


estimates of traffic quantities over network elements are sufficient. 


Operators should also ensure that site numbers and equipment quantities are also within the caps, 


as described in Annex B.1 and Annex B.3. 
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Annex B.3: calculation of the 35% cap for network elements from a particular equipment 
class of 5G, FTTP and other gigabit or higher capable fixed access networks 


This cap is intended to apply to physical quantities of equipment. Operators should determine the 


size of two sets: 


Exctass: the set of the operator’s physical equipment of a particular ‘class’ performing a function 


within the 5G access network or the FTTP and other gigabit or higher capable fixed access 


networks. 


E ictassj(Huawei): the subset of physical equipment within ‘E[class]’ where a non-passive function 


of the equipment is provided with the involvement of Huawei equipment. 


Based upon these values, operators should ensure that, for every class, the following equation is 


true:* 


#E clas Huawei) 


a <0.35 


class] 
Only the operator’s equipment should be included in this calculation. Other operator’s equipment 


should not be included, even if the operator uses this equipment to support part of their network. 


Classes of equipment are deployment dependent, but as an example, the following may be 


appropriate equipment classes: 
5G: gNB DU, gNB CU, gNB small cell, etc. 
GPON: ONT/ONU, OLT 


Operators of fixed networks should also ensure that premises passed are also within the cap as 
described in Annex B.4. Operators of 5G networks should also ensure that site numbers and 


traffic quantities are also within the caps, as described in Annex B.1 and Annex B.2. 


Given the control set out in 4(5) above, operators must not use Huawei equipment to provide 


NFVI and hence the 35% cap is not relevant to the physical infrastructure or hypervisor. 


4 Where ‘#E’ is used to notate the size of the set ‘E’. 
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The use of virtual Huawei functions should then be limited based on number of premises (for 
fixed access networks as described in Annex B.4), and number of sites and traffic quantities (for 


5G networks as described in Question Annex B.1 and Annex B.2). 
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Annex B.4: calculation of the 35% cap of premises passed by FTTP and other gigabit and 
higher capable access networks 


Operators should determine the size of two sets: 


P: The premises passed by the operator using gigabit and higher capable access networks. 
Typically, each premise will have a unique customer termination point (e.g. ONTs) attached to 


the network. 


P(Huawei): the subset of premises within ‘P’, where a non-passive function of the access 


connection (e.g. OLT) is provided with the involvement of Huawei equipment. 


Based on these sets, operators should ensure that the following equation is true: 


#P (Huawei) 


As an example, if an operator provides a fibre service to 20m homes, presumably with the 


potential to support 20m active ONTs, then: 


#P (Huawei) < 0.35. #P = 7m 


Meaning that at most 7m homes may be served by Huawei equipment. 


Operators should also ensure that equipment quantities are also within the cap as described in 


Annex B.3. 


> Where ‘#P’ is used to denote the size of the set ‘P’. 
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ANNEX C: Summary of requirements imposed on Public Communications Providers 


This table summarises the requirements imposed on Public Communications Providers by this 


direction. It is used for explanatory purposes only. It does not form part, nor is it intended to 


provide a comprehensive description, of the requirements imposed. 


Paragraph 
reference 


4(1) 


4(2) 


4(3) 


4(4) 


4(5) 


4(6) and (7) 


4(8) 


4(9) 


4(10) 


Description of requirement 


Not to make use of any Huawei equipment in 5G networks if 
such equipment was procured after 31 December 2020. 


Not to make use of any Huawei equipment, except for fixed 
fibre access equipment, in any network if the manufacturing 
process or supply chain for such equipment has been altered 
as a result of changes to the United States Foreign-Produced 
Direct Product Rule announced on 19 May 2020 and 17 
August 2020. 


Not to make use of Huawei Managed Services in respect of 
any network after 31 March 2021, except for Huawei 
Specialist Maintenance Services provided in relation to 
Huawei equipment already installed in the network prior to 
31 March 2021. 


Not to install Huawei equipment in 5G networks after 30 
September 2021, except for directly maintaining Huawei 
equipment installed before this date. 


Not to make use of Huawei equipment or services in the 
execution of Core Network Functions after 28 January 2023. 


35% cap on use of Huawei equipment in 5G access networks, 
FTTP networks, and other gigabit and higher capable access 
networks after 28 January 2023. 


Not to make use of Huawei equipment or services in parts of 
mobile access networks which could provide service to 
subscribers located at Sites Significant to National Security 


after 28 January 2023. 


Not to make use of Huawei equipment or services in any part 
of its 5G network after 31 December 2027. 


Compliance with the NCSC’s specific mitigation strategy for 
Huawei 


Relevant date 


31 December 2020 


Ongoing 


31 March 2021 


30 September 2021 


28 January 2023 


28 January 2023 


28 January 2023 


31 December 2027 


Ongoing 
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